using System.Collections.Frozen;

using System.IO.Compression;

using System.Text.Json.Nodes;

using System.Threading.RateLimiting;

using Microsoft.AspNetCore.Authentication.BearerToken;

using Microsoft.AspNetCore.Authentication.Cookies;

using Microsoft.AspNetCore.Authentication.JwtBearer;

using Microsoft.AspNetCore.DataProtection;

using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption;

using Microsoft.AspNetCore.DataProtection.AuthenticatedEncryption.ConfigurationModel;

using Microsoft.AspNetCore.DataProtection.KeyManagement;

using Microsoft.AspNetCore.HttpOverrides;

using Microsoft.AspNetCore.RateLimiting;

using Microsoft.AspNetCore.ResponseCompression;

using Microsoft.Extensions.Caching.Hybrid;

using Microsoft.Extensions.Primitives;

using Microsoft.Net.Http.Headers;

using Npgsql;

using NpgsqlRest;

using NpgsqlRestClient.Fido2;

using Serilog;

using Serilog.Extensions.Logging;

using Serilog.Sinks.OpenTelemetry;

namespace NpgsqlRestClient;

public class Builder

{

private readonly Config _config;

public Builder(Config config)

{

_config = config;

}

public WebApplicationBuilder Instance { get; private set; } = default!;

public bool LoggingEnabled { get; private set; } = false;

public Microsoft.Extensions.Logging.ILogger? Logger { get; private set; } = null;

public Microsoft.Extensions.Logging.ILogger? ClientLogger { get; private set; } = null;

public bool UseHttpsRedirection { get; private set; } = false;

public bool UseHsts { get; private set; } = false;

public BearerTokenConfig? BearerTokenConfig { get; private set; } = null;

public JwtTokenConfig? JwtTokenConfig { get; private set; } = null;

/// <summary>BearerToken-type entries registered under <c>Auth:Schemes</c>. Each carries its own scheme name and (optionally) refresh path.</summary>

public List<BearerTokenConfig> AdditionalBearerTokenConfigs { get; } = [];

/// <summary>Jwt-type entries registered under <c>Auth:Schemes</c>. Each carries its own scheme name, secret, validation options and (optionally) refresh path.</summary>

public List<JwtTokenConfig> AdditionalJwtTokenConfigs { get; } = [];

public string? ConnectionString { get; private set; } = null;

public string? ConnectionName { get; private set; } = null;

public ExternalAuthConfig? ExternalAuthConfig { get; private set; } = null;

public PasskeyConfig? PasskeyConfig { get; private set; } = null;

public bool SslEnabled { get; private set; } = false;

public void BuildInstance()

{

var staticFilesCfg = _config.Cfg.GetSection("StaticFiles");

string? webRootPath = staticFilesCfg is not null && _config.GetConfigBool("Enabled", staticFilesCfg) is true ? _config.GetConfigStr("RootPath", staticFilesCfg) ?? "wwwroot" : null;

var options = new WebApplicationOptions()

{

ApplicationName = _config.GetConfigStr("ApplicationName") ?? Path.GetFileName(Environment.CurrentDirectory),

WebRootPath = webRootPath,

EnvironmentName = _config.GetConfigStr("EnvironmentName") ?? "Production",

};

Instance = WebApplication.CreateEmptyBuilder(options);

Instance.WebHost.UseKestrelCore();

var kestrelConfig = _config.Cfg.GetSection("Kestrel");

if (kestrelConfig is not null && kestrelConfig.Exists())

{

var transformedKestrelConfig = _config.TransformSection(kestrelConfig);

Instance.WebHost.ConfigureKestrel((context, options) =>

{

options.Configure(transformedKestrelConfig);

options.DisableStringReuse = _config.GetConfigBool("DisableStringReuse", kestrelConfig, options.DisableStringReuse);

options.AllowAlternateSchemes = _config.GetConfigBool("AllowAlternateSchemes", kestrelConfig, options.AllowAlternateSchemes);

options.AllowSynchronousIO = _config.GetConfigBool("AllowSynchronousIO", kestrelConfig, options.AllowSynchronousIO);

options.AllowResponseHeaderCompression = _config.GetConfigBool("AllowResponseHeaderCompression", kestrelConfig, options.AllowResponseHeaderCompression);

options.AddServerHeader = _config.GetConfigBool("AddServerHeader", kestrelConfig, options.AddServerHeader);

options.AllowHostHeaderOverride = _config.GetConfigBool("AllowSynchronousIO", kestrelConfig, options.AllowHostHeaderOverride);

var limitsSection = transformedKestrelConfig.GetSection("Limits");

if (limitsSection.Exists())

{

limitsSection.Bind(options.Limits);

}

});

}

var urls = _config.GetConfigStr("Urls");

if (urls is not null)

{

Instance.WebHost.UseUrls(urls.Split(';'));

}

else

{

Instance.WebHost.UseUrls("http://localhost:8080");

}

var ssqlCfg = _config.Cfg.GetSection("Ssl");

if (_config.Exists(ssqlCfg) is true)

{

if (_config.GetConfigBool("Enabled", ssqlCfg) is true)

{

SslEnabled = true;

Instance.WebHost.UseKestrelHttpsConfiguration();

UseHttpsRedirection = _config.GetConfigBool("UseHttpsRedirection", ssqlCfg, true);

UseHsts = _config.GetConfigBool("UseHsts", ssqlCfg, true);

}

}

else

{

UseHttpsRedirection = false;

UseHsts = false;

}

}

public WebApplication Build() => Instance.Build();

public void BuildLogger(RetryStrategy? cmdRetryStrategy)

{

var logCfg = _config.Cfg.GetSection("Log");

Logger = null;

var logToConsole = _config.GetConfigBool("ToConsole", logCfg, true);

var logToFile = _config.GetConfigBool("ToFile", logCfg);

var filePath = _config.GetConfigStr("FilePath", logCfg) ?? "logs/log.txt";

var logToPostgres = _config.GetConfigBool("ToPostgres", logCfg);

var postgresCommand = _config.GetConfigStr("PostgresCommand", logCfg);

var logToOpenTelemetry = _config.GetConfigBool("ToOpenTelemetry", logCfg);

if (

logToConsole is true ||

(logToFile is true) ||

(logToPostgres is true && postgresCommand is not null) ||

(logToOpenTelemetry is true))

{

LoggingEnabled = true;

var loggerConfig = new LoggerConfiguration().MinimumLevel.Verbose();

bool npgsqlRestAdded = false;

bool npgsqlRestClientAdded = false;

bool systemAdded = false;

bool microsoftAdded = false;

var appName = _config.GetConfigStr("ApplicationName", _config.Cfg);

var envName = _config.GetConfigStr("EnvironmentName", _config.Cfg) ?? "Production";

string clientLoggerName = string.IsNullOrEmpty(appName) ? "NpgsqlRestClient" : appName;

foreach (var level in logCfg?.GetSection("MinimalLevels")?.GetChildren() ?? [])

{

var key = level.Key;

var value = _config.GetEnum<Serilog.Events.LogEventLevel?>(level.Value);

if (value is not null && key is not null)

{

if (string.Equals(key, "NpgsqlRest", StringComparison.OrdinalIgnoreCase))

{

loggerConfig.MinimumLevel.Override("NpgsqlRest", value.Value);

npgsqlRestAdded = true;

}

else if (string.Equals(key, "NpgsqlRestClient", StringComparison.OrdinalIgnoreCase))

{

loggerConfig.MinimumLevel.Override(clientLoggerName, value.Value);

npgsqlRestClientAdded = true;

}

else if (string.Equals(key, "System", StringComparison.OrdinalIgnoreCase))

{

loggerConfig.MinimumLevel.Override(key, value.Value);

systemAdded = true;

}

else if (string.Equals(key, "Microsoft", StringComparison.OrdinalIgnoreCase))

{

loggerConfig.MinimumLevel.Override(key, value.Value);

microsoftAdded = true;

}

else

{

loggerConfig.MinimumLevel.Override(key, value.Value);

}

}

}

if (npgsqlRestAdded is false)

{

loggerConfig.MinimumLevel.Override("NpgsqlRest", Serilog.Events.LogEventLevel.Information);

}

if (npgsqlRestClientAdded is false)

{

loggerConfig.MinimumLevel.Override(clientLoggerName, Serilog.Events.LogEventLevel.Information);

}

if (systemAdded is false)

{

loggerConfig.MinimumLevel.Override("System", Serilog.Events.LogEventLevel.Warning);

}

if (microsoftAdded is false)

{

loggerConfig.MinimumLevel.Override("Microsoft", Serilog.Events.LogEventLevel.Warning);

}

string outputTemplate = _config.GetConfigStr("OutputTemplate", logCfg) ??

"[{Timestamp:HH:mm:ss.fff} {Level:u3}] {Message:lj} [{SourceContext}]{NewLine}{Exception}";

List<string> logDebug = new(4);

if (logToConsole is true)

{

var minLevel = _config.GetConfigEnum<Serilog.Events.LogEventLevel?>("ConsoleMinimumLevel", logCfg) ?? Serilog.Events.LogEventLevel.Verbose;

loggerConfig = loggerConfig.WriteTo.Console(

restrictedToMinimumLevel: minLevel,

outputTemplate: outputTemplate,

theme: Serilog.Sinks.SystemConsole.Themes.AnsiConsoleTheme.Code);

logDebug.Add(string.Concat("Console (minimum level: ", minLevel.ToString(), ")"));

}

if (logToFile is true)

{

var minLevel = _config.GetConfigEnum<Serilog.Events.LogEventLevel?>("FileMinimumLevel", logCfg) ?? Serilog.Events.LogEventLevel.Verbose;

loggerConfig = loggerConfig.WriteTo.File(

restrictedToMinimumLevel: minLevel,

path: filePath ?? "logs/log.txt",

rollingInterval: RollingInterval.Day,

fileSizeLimitBytes: _config.GetConfigInt("FileSizeLimitBytes", logCfg) ?? 30000000,

retainedFileCountLimit: _config.GetConfigInt("RetainedFileCountLimit", logCfg) ?? 30,

rollOnFileSizeLimit: _config.GetConfigBool("RollOnFileSizeLimit", logCfg, defaultVal: true),

outputTemplate: outputTemplate);

logDebug.Add(string.Concat("Rolling File (minimum level: ", minLevel.ToString(), ")"));

}

if (logToPostgres is true && postgresCommand is not null)

{

var minLevel = _config.GetConfigEnum<Serilog.Events.LogEventLevel?>("PostgresMinimumLevel", logCfg) ?? Serilog.Events.LogEventLevel.Verbose;

loggerConfig = loggerConfig.WriteTo.Postgres(

postgresCommand,

restrictedToMinimumLevel: minLevel,

connectionString: ConnectionString,

cmdRetryStrategy);

logDebug.Add(string.Concat("PostgreSQL Database (minimum level: ", minLevel.ToString(), ", command: ", postgresCommand, ")"));

}

if (logToOpenTelemetry)

{

var minLevel = _config.GetConfigEnum<Serilog.Events.LogEventLevel?>("OTLPMinimumLevel", logCfg) ?? Serilog.Events.LogEventLevel.Verbose;

var endpoint = _config.GetConfigStr("OTLPEndpoint", logCfg) ?? "http://localhost:4317";

var protocol = _config.GetConfigEnum<OtlpProtocol?>("OTLPProtocol", logCfg) ?? OtlpProtocol.Grpc;

loggerConfig = loggerConfig.WriteTo.OpenTelemetry(options =>

{

options.Endpoint = endpoint;

options.Protocol = protocol;

var formatDict = new Dictionary<string, string>

{

["application"] = appName ?? "NpgsqlRest",

["environment"] = envName

};

if (logCfg is not null)

{

options.ResourceAttributes =

(_config.GetConfigDict(logCfg.GetSection("OTLResourceAttributes")) ??

new Dictionary<string, string>())

.ToDictionary(kv => kv.Key,

kv => (object)Formatter.FormatString(kv.Value.AsSpan(), formatDict).ToString());

var headers = _config.GetConfigDict(logCfg.GetSection("OTLPHeaders"));

if (headers is not null && headers.Count > 0)

{

options.Headers = headers;

}

}

options.LevelSwitch = new Serilog.Core.LoggingLevelSwitch(minLevel);

});

logDebug.Add(string.Concat("OpenTelemetry (minimum level: ", minLevel.ToString(), ", endpoint: ", endpoint, ", protocol: ", protocol.ToString(), ")"));

}

var serilog = loggerConfig.CreateLogger();

var serilogFactory = new SerilogLoggerFactory(serilog);

// Core library logger - always uses "NpgsqlRest" name

Logger = serilogFactory.CreateLogger("NpgsqlRest");

// Client application logger - uses ApplicationName or "NpgsqlRestClient"

ClientLogger = serilogFactory.CreateLogger(clientLoggerName);

Instance.Host.UseSerilog(serilog);

var providerString = _config.Cfg.Providers.Select(p =>

{

var str = p.ToString();

if (p is Microsoft.Extensions.Configuration.Json.JsonConfigurationProvider j)

{

if(File.Exists(j.Source.Path) is false)

{

str = str?.Replace("(Optional)", "(Missing)");

}

}

return str;

}).Aggregate((a, b) => string.Concat(a, ", ", b));

ClientLogger?.LogDebug("----> Starting with configuration(s): {providerString}", providerString);

if (logDebug.Count > 0)

{

ClientLogger?.LogDebug("----> Logging enabled: {logDebug}", string.Join(", ", logDebug));

}

}

}

public ErrorHandlingOptions BuildErrorHandlingOptions()

{

var errConfig = _config.Cfg.GetSection("ErrorHandlingOptions");

var defaults = new ErrorHandlingOptions();

if (errConfig.Exists() is false)

{

// Always register ProblemDetails for AOT compatibility

// Apply default behavior: remove traceId (matches default when config exists)

Instance.Services.AddProblemDetails(options =>

{

options.CustomizeProblemDetails = ctx =>

{

ctx.ProblemDetails.Extensions.Remove("traceId");

};

});

var defaultTimeoutLog = defaults.TimeoutErrorMapping?.ToString() ?? "disabled";

var defaultPoliciesLog = defaults.ErrorCodePolicies.Count > 0

? string.Join("; ", defaults.ErrorCodePolicies.Select(p =>

$"{p.Key}: [{string.Join(", ", p.Value.Select(m => $"{m.Key}->{m.Value.StatusCode}"))}]"))

: "none";

ClientLogger?.LogDebug("Using default error handling options: DefaultErrorCodePolicy={DefaultErrorCodePolicy}, TimeoutErrorMapping=[{TimeoutErrorMapping}], ErrorCodePolicies=[{ErrorCodePolicies}]",

defaults.DefaultErrorCodePolicy ?? "Default",

defaultTimeoutLog,

defaultPoliciesLog);

return defaults;

}

var removeTypeUrl = _config.GetConfigBool("RemoveTypeUrl", errConfig);

var removeTraceId = _config.GetConfigBool("RemoveTraceId", errConfig, true);

// Always register ProblemDetails for AOT compatibility

Instance.Services.AddProblemDetails(options =>

{

options.CustomizeProblemDetails = ctx =>

{

// Remove the type field completely

if (removeTypeUrl is true)

{

ctx.ProblemDetails.Type = null;

}

// Remove the traceId extension

if (removeTraceId is true)

{

ctx.ProblemDetails.Extensions.Remove("traceId");

}

};

});

var result = new ErrorHandlingOptions

{

DefaultErrorCodePolicy = _config.GetConfigStr("DefaultErrorCodePolicy", errConfig) ?? defaults.DefaultErrorCodePolicy

};

var timeoutErrorMapping = errConfig.GetSection("TimeoutErrorMapping");

if (timeoutErrorMapping.Exists())

{

var statusCode = _config.GetConfigInt("StatusCode", timeoutErrorMapping);

if (statusCode is not null)

{

result.TimeoutErrorMapping = new()

{

StatusCode = statusCode.Value,

Title = _config.GetConfigStr("Title", timeoutErrorMapping),

Details = _config.GetConfigStr("Details", timeoutErrorMapping),

Type = _config.GetConfigStr("Type", timeoutErrorMapping),

};

}

}

else

{

result.TimeoutErrorMapping = defaults.TimeoutErrorMapping;

}

result.ErrorCodePolicies = new Dictionary<string, Dictionary<string, ErrorCodeMappingOptions>>();

var policiesCfg = errConfig.GetSection("ErrorCodePolicies");

foreach (var policySection in policiesCfg.GetChildren())

{

var policy = _config.GetConfigStr("Name", policySection);

if (string.IsNullOrEmpty(policy))

{

continue;

}

var mappingCfg = policySection.GetSection("ErrorCodes");

var mappingDict = new Dictionary<string, ErrorCodeMappingOptions>();

foreach (var mappingSection in mappingCfg.GetChildren())

{

var errorCode = mappingSection.Key;

if (string.IsNullOrEmpty(errorCode))

{

continue;

}

var statusCode = _config.GetConfigInt("StatusCode", mappingSection);

if (statusCode is null)

{

continue;

}

mappingDict.TryAdd(errorCode, new()

{

StatusCode = statusCode.Value,

Title = _config.GetConfigStr("Title", mappingSection),

Details = _config.GetConfigStr("Details", mappingSection),

Type = _config.GetConfigStr("Type", mappingSection),

});

}

if (mappingDict.Count > 0)

{

result.ErrorCodePolicies[policy] = mappingDict;

}

}

if (result.ErrorCodePolicies.Count == 0)

{

result.ErrorCodePolicies = defaults.ErrorCodePolicies;

}

// Log error handling options

var timeoutLog = result.TimeoutErrorMapping is not null

? result.TimeoutErrorMapping.ToString()

: "disabled";

var policiesLog = result.ErrorCodePolicies.Count > 0

? string.Join("; ", result.ErrorCodePolicies.Select(p =>

$"{p.Key}: [{string.Join(", ", p.Value.Select(m => $"{m.Key}->{m.Value.StatusCode}"))}]"))

: "none";

ClientLogger?.LogDebug("Using error handling options: DefaultErrorCodePolicy={DefaultErrorCodePolicy}, RemoveTypeUrl={RemoveTypeUrl}, RemoveTraceId={RemoveTraceId}, TimeoutErrorMapping=[{TimeoutErrorMapping}], ErrorCodePolicies=[{ErrorCodePolicies}]",

result.DefaultErrorCodePolicy ?? "Default",

removeTypeUrl,

removeTraceId,

timeoutLog,

policiesLog);

return result;

}

public enum DataProtectionStorage

{

Default,

FileSystem,

Database

}

public enum KeyEncryptionMethod

{

None,

Certificate,

Dpapi // Windows only

}

public string? BuildDataProtection(RetryStrategy? cmdRetryStrategy)

{

var dataProtectionCfg = _config.Cfg.GetSection("DataProtection");

if (_config.Exists(dataProtectionCfg) is false || _config.GetConfigBool("Enabled", dataProtectionCfg) is false)

{

return null;

}

var dataProtectionBuilder = Instance.Services.AddDataProtection();

var encryptionAlgorithm = _config.GetConfigEnum<EncryptionAlgorithm?>("EncryptionAlgorithm", dataProtectionCfg);

var validationAlgorithm = _config.GetConfigEnum<ValidationAlgorithm?>("ValidationAlgorithm", dataProtectionCfg);

if (encryptionAlgorithm is not null || validationAlgorithm is not null)

{

dataProtectionBuilder.UseCryptographicAlgorithms(new AuthenticatedEncryptorConfiguration

{

EncryptionAlgorithm = encryptionAlgorithm ?? EncryptionAlgorithm.AES_256_CBC,

ValidationAlgorithm = validationAlgorithm ?? ValidationAlgorithm.HMACSHA256

});

}

DirectoryInfo? dirInfo = null;

var storage = _config.GetConfigEnum<DataProtectionStorage?>("Storage", dataProtectionCfg) ?? DataProtectionStorage.Default;

if (storage == DataProtectionStorage.FileSystem)

{

var path = _config.GetConfigStr("FileSystemPath", dataProtectionCfg);

if (string.IsNullOrEmpty(path) is true)

{

throw new ArgumentException("FileSystemPath value in DataProtection can't be null or empty when using FileSystem Storage");

}

dirInfo = new DirectoryInfo(path);

dataProtectionBuilder.PersistKeysToFileSystem(dirInfo);

}

else if (storage == DataProtectionStorage.Database)

{

var getAllElementsCommand = _config.GetConfigStr("GetAllElementsCommand", dataProtectionCfg) ?? "select get_data_protection_keys()";

var storeElementCommand = _config.GetConfigStr("StoreElementCommand", dataProtectionCfg) ?? "call store_data_protection_keys($1,$2)";

Instance.Services.Configure<KeyManagementOptions>(options =>

{

options.XmlRepository = new DbDataProtection(

ConnectionString,

getAllElementsCommand,

storeElementCommand,

cmdRetryStrategy,

Logger);

});

}

var keyEncryption = _config.GetConfigEnum<KeyEncryptionMethod?>("KeyEncryption", dataProtectionCfg) ?? KeyEncryptionMethod.None;

if (keyEncryption == KeyEncryptionMethod.Certificate)

{

var certPath = _config.GetConfigStr("CertificatePath", dataProtectionCfg);

if (string.IsNullOrEmpty(certPath))

{

throw new ArgumentException("CertificatePath value in DataProtection can't be null or empty when using Certificate KeyEncryption");

}

var certPassword = _config.GetConfigStr("CertificatePassword", dataProtectionCfg);

if (string.IsNullOrEmpty(certPassword))

{

dataProtectionBuilder.ProtectKeysWithCertificate(System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12FromFile(certPath, null));

}

else

{

dataProtectionBuilder.ProtectKeysWithCertificate(System.Security.Cryptography.X509Certificates.X509CertificateLoader.LoadPkcs12FromFile(certPath, certPassword));

}

ClientLogger?.LogDebug("Data Protection keys encrypted with certificate from {certPath}", certPath);

}

else if (keyEncryption == KeyEncryptionMethod.Dpapi)

{

if (OperatingSystem.IsWindows() is false)

{

throw new PlatformNotSupportedException("DPAPI key encryption is only supported on Windows");

}

var protectToLocalMachine = _config.GetConfigBool("DpapiLocalMachine", dataProtectionCfg);

#pragma warning disable CA1416 // Validate platform compatibility - already checked above

dataProtectionBuilder.ProtectKeysWithDpapi(protectToLocalMachine);

#pragma warning restore CA1416

ClientLogger?.LogDebug("Data Protection keys encrypted with DPAPI (LocalMachine: {protectToLocalMachine})", protectToLocalMachine);

}

var expiresInDays = _config.GetConfigInt("DefaultKeyLifetimeDays", dataProtectionCfg) ?? 90;

dataProtectionBuilder.SetDefaultKeyLifetime(TimeSpan.FromDays(expiresInDays));

var customAppName = _config.GetConfigStr("CustomApplicationName", dataProtectionCfg);

if (string.IsNullOrEmpty(customAppName) is true)

{

customAppName = Instance.Environment.ApplicationName;

}

dataProtectionBuilder.SetApplicationName(customAppName);

if (storage == DataProtectionStorage.Default)

{

ClientLogger?.LogDebug("Using Data Protection for application {customAppName} with default provider. Expiration in {expiresInDays} days.",

customAppName,

expiresInDays);

}

else

{

ClientLogger?.LogDebug($"Using Data Protection for application {{customAppName}} in{(dirInfo is null ? " " : " directory ")}{{dirInfo}}. Expiration in {{expiresInDays}} days.",

customAppName,

dirInfo?.FullName ?? "database",

expiresInDays);

}

return customAppName;

}

public void BuildAuthentication()

{

var authCfg = _config.Cfg.GetSection("Auth");

bool cookieAuth = false;

bool bearerTokenAuth = false;

bool jwtAuth = false;

if (_config.Exists(authCfg) is true)

{

cookieAuth = _config.GetConfigBool("CookieAuth", authCfg);

bearerTokenAuth = _config.GetConfigBool("BearerTokenAuth", authCfg);

jwtAuth = _config.GetConfigBool("JwtAuth", authCfg);

}

if (cookieAuth is false && bearerTokenAuth is false && jwtAuth is false)

{

return;

}

var cookieScheme = _config.GetConfigStr("CookieAuthScheme", authCfg) ?? CookieAuthenticationDefaults.AuthenticationScheme;

var tokenScheme = _config.GetConfigStr("BearerTokenAuthScheme", authCfg) ?? BearerTokenDefaults.AuthenticationScheme;

var jwtScheme = _config.GetConfigStr("JwtAuthScheme", authCfg) ?? JwtBearerDefaults.AuthenticationScheme;

// Build default scheme name based on enabled auth methods

var enabledSchemes = new List<string>();

if (cookieAuth) enabledSchemes.Add(cookieScheme);

if (bearerTokenAuth) enabledSchemes.Add(tokenScheme);

if (jwtAuth) enabledSchemes.Add(jwtScheme);

string defaultScheme = enabledSchemes.Count switch

{

1 => enabledSchemes[0],

_ => string.Join("_and_", enabledSchemes)

};

// Fail fast if any of the four legacy integer time fields is still present in the user's config

// (CookieValidDays / BearerTokenExpireHours / JwtExpireMinutes / JwtRefreshExpireDays). They were

// removed in 3.13.0 in favor of the interval-notation fields.

DetectLegacyAuthTimeFields(authCfg);

var auth = Instance.Services.AddAuthentication(defaultScheme);

if (cookieAuth is true)

{

var cookieValid = ResolveAuthTimeSpan("CookieValid", TimeSpan.FromDays(14), authCfg);

auth.AddCookie(cookieScheme, options =>

{

options.ExpireTimeSpan = cookieValid;

var name = _config.GetConfigStr("CookieName", authCfg);

if (string.IsNullOrEmpty(name) is false)

{

options.Cookie.Name = _config.GetConfigStr("CookieName", authCfg);

}

options.Cookie.Path = _config.GetConfigStr("CookiePath", authCfg);

options.Cookie.Domain = _config.GetConfigStr("CookieDomain", authCfg);

options.Cookie.MaxAge = _config.GetConfigBool("CookieMultiSessions", authCfg, true) is true ? cookieValid : null;

options.Cookie.HttpOnly = _config.GetConfigBool("CookieHttpOnly", authCfg, true) is true;

});

ClientLogger?.LogDebug("Using Cookie Authentication with scheme {cookieScheme}. Cookie expires in {cookieValid}.", cookieScheme, cookieValid);

}

if (bearerTokenAuth is true)

{

var bearerExpire = ResolveAuthTimeSpan("BearerTokenExpire", TimeSpan.FromHours(1), authCfg);

BearerTokenConfig = new()

{

Scheme = tokenScheme,

RefreshPath = _config.GetConfigStr("BearerTokenRefreshPath", authCfg)

};

auth.AddBearerToken(tokenScheme, options =>

{

options.BearerTokenExpiration = bearerExpire;

options.RefreshTokenExpiration = bearerExpire;

options.Validate();

});

ClientLogger?.LogDebug(

"Using Bearer Token Authentication with scheme {tokenScheme}. Token expires in {bearerExpire}. Refresh path is {RefreshPath}",

tokenScheme,

bearerExpire,

BearerTokenConfig.RefreshPath);

}

if (jwtAuth is true)

{

var jwtSecret = _config.GetConfigStr("JwtSecret", authCfg);

if (string.IsNullOrEmpty(jwtSecret))

{

throw new InvalidOperationException("JwtSecret must be configured when JwtAuth is enabled. The secret must be at least 32 characters for HS256.");

}

if (jwtSecret.Length < 32)

{

throw new InvalidOperationException("JwtSecret must be at least 32 characters long for HS256 algorithm.");

}

var jwtExpire = ResolveAuthTimeSpan("JwtExpire", TimeSpan.FromMinutes(60), authCfg);

var jwtRefreshExpire = ResolveAuthTimeSpan("JwtRefreshExpire", TimeSpan.FromDays(7), authCfg);

var clockSkew = Parser.ParsePostgresInterval(_config.GetConfigStr("JwtClockSkew", authCfg)) ?? TimeSpan.FromMinutes(5);

JwtTokenConfig = new()

{

Scheme = jwtScheme,

Secret = jwtSecret,

Issuer = _config.GetConfigStr("JwtIssuer", authCfg),

Audience = _config.GetConfigStr("JwtAudience", authCfg),

Expire = jwtExpire,

RefreshExpire = jwtRefreshExpire,

ValidateIssuer = _config.GetConfigBool("JwtValidateIssuer", authCfg),

ValidateAudience = _config.GetConfigBool("JwtValidateAudience", authCfg),

ValidateLifetime = _config.GetConfigBool("JwtValidateLifetime", authCfg, true),

ValidateIssuerSigningKey = _config.GetConfigBool("JwtValidateIssuerSigningKey", authCfg, true),

ClockSkew = clockSkew,

RefreshPath = _config.GetConfigStr("JwtRefreshPath", authCfg)

};

auth.AddJwtBearer(jwtScheme, options =>

{

options.TokenValidationParameters = JwtTokenConfig.GetTokenValidationParameters();

options.SaveToken = true;

});

ClientLogger?.LogDebug(

"Using JWT Authentication with scheme {jwtScheme}. Access token expires in {jwtExpire}. Refresh token expires in {jwtRefreshExpire}. Refresh path is {RefreshPath}",

jwtScheme,

jwtExpire,

jwtRefreshExpire,

JwtTokenConfig.RefreshPath);

}

// Register additional authentication schemes from Auth:Schemes. Each enabled entry registers a

// fully-fledged ASP.NET Core authentication scheme (Cookie, BearerToken, or Jwt) so a login

// function can return that scheme's name in its `scheme` column to sign in under those options.

RegisterAuthSchemes(auth, authCfg, cookieScheme, tokenScheme, jwtScheme);

// Create policy scheme if multiple auth methods are enabled

if (enabledSchemes.Count > 1)

{

auth.AddPolicyScheme(defaultScheme, defaultScheme, options =>

{

// runs on each request

options.ForwardDefaultSelector = context =>

{

string? authorization = context.Request.Headers[HeaderNames.Authorization];

if (string.IsNullOrEmpty(authorization) is false && authorization.StartsWith("Bearer "))

{

// For Bearer tokens, we need to determine if it's JWT or Microsoft Bearer Token

// JWT tokens are in format: xxxxx.yyyyy.zzzzz (three Base64 parts separated by dots)

var token = authorization["Bearer ".Length..].Trim();

if (jwtAuth && IsJwtToken(token))

{

return jwtScheme;

}

if (bearerTokenAuth)

{

return tokenScheme;

}

}

// Default to cookie auth if enabled

if (cookieAuth)

{

return cookieScheme;

}

// Fallback to first enabled scheme

return enabledSchemes[0];

};

});

}

if (cookieAuth || bearerTokenAuth || jwtAuth)

{

ExternalAuthConfig = new ExternalAuthConfig();

ExternalAuthConfig.Build(authCfg, _config, this);

}

}

/// <summary>

/// Resolves an auth-related <see cref="TimeSpan"/> from a Postgres-interval string at the given key.

/// Returns <paramref name="defaultValue"/> when the field is null/empty/missing. Throws on

/// syntactically invalid interval values (fail-fast at startup).

///

/// Reads from the section provided in <paramref name="authCfg"/> — this is reused for both the root

/// <c>Auth</c> section and individual <c>Auth:Schemes:&lt;name&gt;</c> sections.

/// </summary>

public TimeSpan ResolveAuthTimeSpan(string key, TimeSpan defaultValue, IConfigurationSection authCfg)

{

var raw = _config.GetConfigStr(key, authCfg);

if (string.IsNullOrWhiteSpace(raw))

{

return defaultValue;

}

return Parser.ParsePostgresInterval(raw)

?? throw new InvalidOperationException(

$"Invalid interval value for {authCfg.Path}:{key}: '{raw}'. Expected Postgres interval syntax (e.g. '14 days', '1 hour', '60 minutes').");

}

/// <summary>

/// Throws if any of the four removed legacy auth time fields appears in the user's config. We

/// hard-cut these in 3.13.0 (interval notation is the only supported form). Failing fast — rather

/// than silently ignoring legacy fields — prevents the surprising case where an upgraded user's

/// "this should be 30 days" expiration silently flips to the new field's default of 14 days.

/// </summary>

private void DetectLegacyAuthTimeFields(IConfigurationSection authCfg)

{

DetectLegacyAuthTimeField(authCfg, "CookieValidDays", "CookieValid", "e.g. \"14 days\"");

DetectLegacyAuthTimeField(authCfg, "BearerTokenExpireHours", "BearerTokenExpire", "e.g. \"1 hour\"");

DetectLegacyAuthTimeField(authCfg, "JwtExpireMinutes", "JwtExpire", "e.g. \"60 minutes\"");

DetectLegacyAuthTimeField(authCfg, "JwtRefreshExpireDays", "JwtRefreshExpire", "e.g. \"7 days\"");

}

private void DetectLegacyAuthTimeField(IConfigurationSection authCfg, string legacyKey, string newKey, string example)

{

// Distinguish "key explicitly set" from "key absent" by checking the section directly. Calling

// GetConfigStr/GetConfigInt would return null in both cases.

var section = authCfg.GetSection(legacyKey);

if (section.Value is null && !section.GetChildren().Any())

{

return;

}

throw new InvalidOperationException(

$"Auth:{legacyKey} has been removed in 3.13.0. Use Auth:{newKey} with Postgres interval syntax instead ({example}). " +

$"See changelog/v3.13.0.md for migration details.");

}

/// <summary>

/// Registers additional authentication schemes declared under <c>Auth:Schemes</c>. Each enabled

/// entry becomes a fully-fledged ASP.NET Core authentication scheme of type Cookies, BearerToken,

/// or Jwt — login functions returning the scheme's name in the <c>scheme</c> column sign in under

/// those options.

///

/// All scheme types inherit any unset field from the root <c>Auth</c> section so blocks stay small.

/// Validation (fail-fast at startup):

/// <list type="bullet">

/// <item>Scheme name must not collide with the main scheme names (CookieAuthScheme,

/// BearerTokenAuthScheme, JwtAuthScheme).</item>

/// <item><c>Type</c> must be one of Cookies / BearerToken / Jwt (case-insensitive).</item>

/// <item>Explicit <c>CookieName</c> values must be unique across all cookie schemes.</item>

/// <item>Refresh paths must be unique across all schemes that define one.</item>

/// <item>Jwt schemes inherit <c>JwtSecret</c> from root if unset; secret must be ≥32 chars.</item>

/// </list>

///

/// BearerToken/Jwt scheme configs are appended to <see cref="AdditionalBearerTokenConfigs"/> /

/// <see cref="AdditionalJwtTokenConfigs"/> so <see cref="App"/> can wire per-scheme refresh

/// middlewares and the <see cref="JwtLoginHandler"/> can resolve the right config when a login

/// function returns one of these scheme names.

/// </summary>

public void RegisterAuthSchemes(

Microsoft.AspNetCore.Authentication.AuthenticationBuilder auth,

IConfigurationSection authCfg,

string cookieScheme,

string tokenScheme,

string jwtScheme)

{

var schemesCfg = authCfg.GetSection("Schemes");

if (!schemesCfg.Exists())

{

return;

}

// Track CookieName values across the main cookie scheme + Cookie-type schemes that set one

// explicitly. Schemes that don't set CookieName use ASP.NET's per-scheme `.AspNetCore.<name>`

// default which auto-differs and is excluded from collision tracking.

var explicitCookieNames = new HashSet<string>(StringComparer.Ordinal);

var mainCookieName = _config.GetConfigStr("CookieName", authCfg);

if (!string.IsNullOrEmpty(mainCookieName))

{

explicitCookieNames.Add(mainCookieName);

}

// Track refresh paths across the main scheme + every BearerToken/Jwt-type scheme that defines

// one. Two middlewares listening on the same path would race — fail at startup instead.

var refreshPaths = new HashSet<string>(StringComparer.OrdinalIgnoreCase);

var mainBearerRefreshPath = _config.GetConfigStr("BearerTokenRefreshPath", authCfg);

if (!string.IsNullOrEmpty(mainBearerRefreshPath))

{

refreshPaths.Add(mainBearerRefreshPath);

}

var mainJwtRefreshPath = _config.GetConfigStr("JwtRefreshPath", authCfg);

if (!string.IsNullOrEmpty(mainJwtRefreshPath))

{

refreshPaths.Add(mainJwtRefreshPath);

}

foreach (var schemeSection in schemesCfg.GetChildren())

{

var schemeName = schemeSection.Key;

if (string.IsNullOrWhiteSpace(schemeName))

{

throw new InvalidOperationException("Auth:Schemes contains an entry with an empty name.");

}

if (_config.GetConfigBool("Enabled", schemeSection, true) is false)

{

ClientLogger?.LogDebug("Auth scheme {SchemeName} is disabled. Skipping.", schemeName);

continue;

}

var typeStr = _config.GetConfigStr("Type", schemeSection);

if (string.IsNullOrWhiteSpace(typeStr))

{

throw new InvalidOperationException(

$"Auth:Schemes:{schemeName}:Type is required. Valid: Cookies, BearerToken, Jwt.");

}

// Scheme name must not shadow any main scheme — otherwise AddX(name, …) would either

// overwrite the main scheme's options or throw on duplicate registration.

if (string.Equals(schemeName, cookieScheme, StringComparison.Ordinal)

|| string.Equals(schemeName, tokenScheme, StringComparison.Ordinal)

|| string.Equals(schemeName, jwtScheme, StringComparison.Ordinal))

{

throw new InvalidOperationException(

$"Auth:Schemes:{schemeName}: scheme name collides with a main authentication scheme " +

$"(CookieAuthScheme/BearerTokenAuthScheme/JwtAuthScheme). Choose a distinct name.");

}

if (string.Equals(typeStr, "Cookies", StringComparison.OrdinalIgnoreCase))

{

RegisterCookieSchemeFromConfig(auth, authCfg, schemeSection, schemeName, mainCookieName, explicitCookieNames);

}

else if (string.Equals(typeStr, "BearerToken", StringComparison.OrdinalIgnoreCase))

{

RegisterBearerTokenSchemeFromConfig(auth, authCfg, schemeSection, schemeName, refreshPaths);

}

else if (string.Equals(typeStr, "Jwt", StringComparison.OrdinalIgnoreCase))

{

RegisterJwtSchemeFromConfig(auth, authCfg, schemeSection, schemeName, refreshPaths);

}

else

{

throw new InvalidOperationException(

$"Auth:Schemes:{schemeName}:Type='{typeStr}' is not supported. Valid: Cookies, BearerToken, Jwt.");

}

}

}

private void RegisterCookieSchemeFromConfig(

Microsoft.AspNetCore.Authentication.AuthenticationBuilder auth,

IConfigurationSection authCfg,

IConfigurationSection schemeSection,

string schemeName,

string? mainCookieName,

HashSet<string> explicitCookieNames)

{

// CookieValid: scheme override wins, else inherit root's resolved value, else default 14 days.

var expire = ResolveSchemeIntervalWithRootFallback(

schemeSection, authCfg, "CookieValid", TimeSpan.FromDays(14));

var schemeCookieName = _config.GetConfigStr("CookieName", schemeSection);

if (string.IsNullOrEmpty(schemeCookieName))

{

schemeCookieName = mainCookieName;

}

else if (!explicitCookieNames.Add(schemeCookieName))

{

throw new InvalidOperationException(

$"Auth:Schemes:{schemeName}:CookieName='{schemeCookieName}' collides with another scheme's CookieName. " +

$"Each scheme (and the main cookie scheme) that sets CookieName explicitly must use a distinct value.");

}

var path = _config.GetConfigStr("CookiePath", schemeSection)

?? _config.GetConfigStr("CookiePath", authCfg);

var domain = _config.GetConfigStr("CookieDomain", schemeSection)

?? _config.GetConfigStr("CookieDomain", authCfg);

var multiSessions = _config.GetConfigBool("CookieMultiSessions", schemeSection,

_config.GetConfigBool("CookieMultiSessions", authCfg, true));

var httpOnly = _config.GetConfigBool("CookieHttpOnly", schemeSection,

_config.GetConfigBool("CookieHttpOnly", authCfg, true));

// Capture locals for the closure (avoid loop-variable issues).

var name = schemeCookieName;

var capturedPath = path;

var capturedDomain = domain;

var capturedMulti = multiSessions;

var capturedHttp = httpOnly;

var capturedExpire = expire;

auth.AddCookie(schemeName, options =>

{

options.ExpireTimeSpan = capturedExpire;

if (!string.IsNullOrEmpty(name))

{

options.Cookie.Name = name;

}

options.Cookie.Path = capturedPath;

options.Cookie.Domain = capturedDomain;

options.Cookie.MaxAge = capturedMulti ? capturedExpire : null;

options.Cookie.HttpOnly = capturedHttp;

});

ClientLogger?.LogDebug(

"Registered Auth Scheme {SchemeName} (Type=Cookies). Expires in {Expire}. MultiSessions={Multi}, HttpOnly={Http}, CookieName={CookieName}.",

schemeName, expire, multiSessions, httpOnly, name ?? $"<default `.AspNetCore.{schemeName}`>");

}

private void RegisterBearerTokenSchemeFromConfig(

Microsoft.AspNetCore.Authentication.AuthenticationBuilder auth,

IConfigurationSection authCfg,

IConfigurationSection schemeSection,

string schemeName,

HashSet<string> refreshPaths)

{

var expire = ResolveSchemeIntervalWithRootFallback(

schemeSection, authCfg, "BearerTokenExpire", TimeSpan.FromHours(1));

// RefreshPath is per-scheme (no root inheritance — each scheme owns its refresh middleware or

// doesn't have one). Empty/null = no refresh middleware for this scheme.

var refreshPath = _config.GetConfigStr("BearerTokenRefreshPath", schemeSection);

if (!string.IsNullOrEmpty(refreshPath) && !refreshPaths.Add(refreshPath))

{

throw new InvalidOperationException(

$"Auth:Schemes:{schemeName}:BearerTokenRefreshPath='{refreshPath}' collides with another scheme's refresh path. " +

$"Each refresh path must be unique across the main scheme and every scheme that defines one.");

}

var capturedExpire = expire;

auth.AddBearerToken(schemeName, options =>

{

options.BearerTokenExpiration = capturedExpire;

options.RefreshTokenExpiration = capturedExpire;

options.Validate();

});

AdditionalBearerTokenConfigs.Add(new BearerTokenConfig

{

Scheme = schemeName,

RefreshPath = refreshPath

});

ClientLogger?.LogDebug(

"Registered Auth Scheme {SchemeName} (Type=BearerToken). Expires in {Expire}. RefreshPath={RefreshPath}.",

schemeName, expire, refreshPath ?? "<none>");

}

private void RegisterJwtSchemeFromConfig(

Microsoft.AspNetCore.Authentication.AuthenticationBuilder auth,

IConfigurationSection authCfg,